Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
29/05/2023, 09:26
Static task
static1
General
-
Target
8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe
-
Size
4.2MB
-
MD5
8d0b8f43b2ffb6522410fe96919c815a
-
SHA1
3958cccac8d92ad681d75a39a72227447f59cb0e
-
SHA256
8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8
-
SHA512
75df7c645e92f7820439e0f1597603488c0cc61759cb45a5436adf8451759466752737d13bf4e9dc5e50afaa04d1e5a9e0c23711e960763b6df7ef70a440495f
-
SSDEEP
98304:n2FCBFlwInBnvoxMm3AMa/Fuiv5xCkjo1bUaPD+:osTxn1oCMqCkjo1IaPC
Malware Config
Signatures
-
Glupteba payload 16 IoCs
resource yara_rule behavioral1/memory/2876-120-0x0000000002FE0000-0x00000000038CB000-memory.dmp family_glupteba behavioral1/memory/2876-267-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2876-417-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2536-687-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2536-1150-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1429-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1883-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1889-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1890-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1891-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1892-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1893-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1894-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1895-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1896-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3088-1897-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 5108 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 3088 csrss.exe 2792 injector.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe = "0" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe File created C:\Windows\rss\csrss.exe 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3228 schtasks.exe 4020 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 348 powershell.exe 348 powershell.exe 348 powershell.exe 2876 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2876 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2248 powershell.exe 2248 powershell.exe 2248 powershell.exe 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 3880 powershell.exe 3880 powershell.exe 3880 powershell.exe 2788 powershell.exe 2788 powershell.exe 2788 powershell.exe 2588 powershell.exe 2588 powershell.exe 2588 powershell.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 4928 powershell.exe 4928 powershell.exe 4928 powershell.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 3088 csrss.exe 3088 csrss.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 3088 csrss.exe 3088 csrss.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe 2792 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 348 powershell.exe Token: SeDebugPrivilege 2876 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Token: SeImpersonatePrivilege 2876 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe Token: SeDebugPrivilege 2248 powershell.exe Token: SeDebugPrivilege 3880 powershell.exe Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 2588 powershell.exe Token: SeDebugPrivilege 5100 powershell.exe Token: SeDebugPrivilege 4928 powershell.exe Token: SeSystemEnvironmentPrivilege 3088 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2876 wrote to memory of 348 2876 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 67 PID 2876 wrote to memory of 348 2876 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 67 PID 2876 wrote to memory of 348 2876 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 67 PID 2536 wrote to memory of 2248 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 72 PID 2536 wrote to memory of 2248 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 72 PID 2536 wrote to memory of 2248 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 72 PID 2536 wrote to memory of 4920 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 74 PID 2536 wrote to memory of 4920 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 74 PID 4920 wrote to memory of 5108 4920 cmd.exe 76 PID 4920 wrote to memory of 5108 4920 cmd.exe 76 PID 2536 wrote to memory of 3880 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 77 PID 2536 wrote to memory of 3880 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 77 PID 2536 wrote to memory of 3880 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 77 PID 2536 wrote to memory of 2788 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 79 PID 2536 wrote to memory of 2788 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 79 PID 2536 wrote to memory of 2788 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 79 PID 2536 wrote to memory of 3088 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 81 PID 2536 wrote to memory of 3088 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 81 PID 2536 wrote to memory of 3088 2536 8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe 81 PID 3088 wrote to memory of 2588 3088 csrss.exe 82 PID 3088 wrote to memory of 2588 3088 csrss.exe 82 PID 3088 wrote to memory of 2588 3088 csrss.exe 82 PID 3088 wrote to memory of 5100 3088 csrss.exe 89 PID 3088 wrote to memory of 5100 3088 csrss.exe 89 PID 3088 wrote to memory of 5100 3088 csrss.exe 89 PID 3088 wrote to memory of 4928 3088 csrss.exe 91 PID 3088 wrote to memory of 4928 3088 csrss.exe 91 PID 3088 wrote to memory of 4928 3088 csrss.exe 91 PID 3088 wrote to memory of 2792 3088 csrss.exe 93 PID 3088 wrote to memory of 2792 3088 csrss.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe"C:\Users\Admin\AppData\Local\Temp\8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:348
-
-
C:\Users\Admin\AppData\Local\Temp\8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe"C:\Users\Admin\AppData\Local\Temp\8b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:5108
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3880
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3228
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3464
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2792
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4020
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5cea505293b2e23a658c7d6faf1e794d2
SHA18fff07ef790f5a83c22392187e40c61f455dc724
SHA256877aefeec8560d7d6e49ce958d4068015570829e0c5d8041518edd78aa77fb26
SHA512e6f4608dfd30ab8aa7335665331115060a628ea78fc207b82829af9efb5b0c5723b449256559ce73f213a913074e71301391f303b1f107177b01052e64d20bec
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD55dc1608c80132f39c3d4797694a6f841
SHA1102c2bbfd474cab49adee9a8f136b523d55dedd8
SHA25636f1750e0b12dc70e8b555235d6b0075c9ece9183147497c05a5b0d93fa4764a
SHA512146774ed17bc5369e0548af0c4e1dd843c3817fe229789e62cdedbe3ac9f35d0d59a00f6fa4134e77b895babad8b5b039b19a746a225f27437efb58337c842f1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD56d4fcd4b2e794bdfaf707d1dd9852dcf
SHA137b30e27784843e7f17b1e762c80d6c140d309cf
SHA25674b0d65c63f6b7b817672bb033c577223a5fe2f663813b3be99ee62fa028f6fb
SHA51267450c74ac911eac610524f4d639cdb99aaee0606160b772bb253ce468ce258847a7d1a09ffefd50865e0d66ea26425e7e18b67ad757c3e533493c2b53da3990
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD593922980fda83e333dda579024f5b9a9
SHA11b314c97fbbbb9c596d4eaf97c9e5076dc9482a8
SHA256890570d2df811d7365611866ed0bcf3ccb55ef0472a3ac1a3fce03ce9523403d
SHA5120de56822852b1708ac77bb0701620a9a05474ad5def9a1cc3543c30106a1dce103c86efd286f49aefd21671532f0a27de09b38028a8c38ef669c27239a517dac
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5f4d95ccbbbc2f0f39006414116a7c508
SHA101559b04bfce5c61632bd52b9f263ae20c050c1b
SHA2563a6877acb1348d3bfc912cccc15a22b697fe977c8d842b5951304806bc942f71
SHA51237937227590843aab7362a640bac33e3cbd9877b5bf43366913905378d0493067c16c6dbe7d268f4e8f83b0252cc2d69d55094380f5f067f1b06c9b7b089fea0
-
Filesize
4.2MB
MD58d0b8f43b2ffb6522410fe96919c815a
SHA13958cccac8d92ad681d75a39a72227447f59cb0e
SHA2568b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8
SHA51275df7c645e92f7820439e0f1597603488c0cc61759cb45a5436adf8451759466752737d13bf4e9dc5e50afaa04d1e5a9e0c23711e960763b6df7ef70a440495f
-
Filesize
4.2MB
MD58d0b8f43b2ffb6522410fe96919c815a
SHA13958cccac8d92ad681d75a39a72227447f59cb0e
SHA2568b3cf889e354dbfbdf735f6068642cac7c25aa2de9ac16a387191870c5d526f8
SHA51275df7c645e92f7820439e0f1597603488c0cc61759cb45a5436adf8451759466752737d13bf4e9dc5e50afaa04d1e5a9e0c23711e960763b6df7ef70a440495f